# CVEs published 2019-12-24

21 CVEs were published on December 24, 2019: 1 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-19960](https://cve.now/CVE-2019-19960.md): In wolfSSL before 4.3.0, wc\_ecc\_mulmod\_ex does not properly resist side-channel attacks. (no CVSS)
- [CVE-2019-19962](https://cve.now/CVE-2019-19962.md): wolfSSL before 4.3.0 mishandles calls to wc\_SignatureGenerateHash, leading to fault injection in RSA cryptography. (no CVSS)
- [CVE-2019-19963](https://cve.now/CVE-2019-19963.md): An issue was discovered in wolfSSL before 4.3.0 in a non-default configuration where DSA is enabled. (no CVSS)
- [CVE-2019-19958](https://cve.now/CVE-2019-19958.md): In libIEC61850 1.4.0, StringUtils\_createStringFromBuffer in common/string\_utilities.c has an integer signedness issue that could lead to an (no CVSS)
- [CVE-2019-19957](https://cve.now/CVE-2019-19957.md): In libIEC61850 1.4.0, getNumberOfElements in mms/iso\_mms/server/mms\_access\_result.c has an out-of-bounds read vulnerability, related to bufP (no CVSS)
- [CVE-2019-10758](https://cve.now/CVE-2019-10758.md): mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the \`toBSON\` method. (CVSS 9.9, KEV, mongo-express)
- [CVE-2019-5702](https://cve.now/CVE-2019-5702.md): NVIDIA GeForce Experience, all versions prior to 3.20.2, contains a vulnerability when GameStream is enabled in which an attacker with local (no CVSS, NVIDIA GeForce Experience)
- [CVE-2019-19925](https://cve.now/CVE-2019-19925.md): zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive. (no CVSS)
- [CVE-2019-19924](https://cve.now/CVE-2019-19924.md): SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. (no CVSS)
- [CVE-2019-19923](https://cve.now/CVE-2019-19923.md): flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side i (no CVSS)
- [CVE-2019-19956](https://cve.now/CVE-2019-19956.md): xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc-\>oldNs. (CVSS 7.5)
- [CVE-2019-18249](https://cve.now/CVE-2019-18249.md): Reliable Controls MACH-ProWebCom/Sys, all versions prior to 2.15 (Firmware versions prior to 8.26.4), may allow attacker to execute commands (no CVSS, Reliable Controls MACH-ProWebCom/Sys)
- [CVE-2019-19954](https://cve.now/CVE-2019-19954.md): Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\\node\_modules\\.bin\\wmi (no CVSS)
- [CVE-2017-16778](https://cve.now/CVE-2017-16778.md): An access control weakness in the DTMF tone receiver of Fermax Outdoor Panel allows physical attackers to inject a Dual-Tone-Multi-Frequency (no CVSS)
- [CVE-2019-19695](https://cve.now/CVE-2019-19695.md): A privilege escalation vulnerability in Trend Micro Antivirus for Mac 2019 (v9.0.1379 and below) could potentially allow an attacker to crea (no CVSS, Trend Micro Antivirus for Mac)
- [CVE-2019-19948](https://cve.now/CVE-2019-19948.md): In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c. (no CVSS)
- [CVE-2019-19950](https://cve.now/CVE-2019-19950.md): In GraphicsMagick 1.4 snapshot-20190403 Q8, there is a use-after-free in ThrowException and ThrowLoggedException of magick/error.c. (no CVSS)
- [CVE-2019-19951](https://cve.now/CVE-2019-19951.md): In GraphicsMagick 1.4 snapshot-20190423 Q8, there is a heap-based buffer overflow in the function ImportRLEPixels of coders/miff.c. (no CVSS)
- [CVE-2019-19953](https://cve.now/CVE-2019-19953.md): In GraphicsMagick 1.4 snapshot-20191208 Q8, there is a heap-based buffer over-read in the function EncodeImage of coders/pict.c. (no CVSS)
- [CVE-2019-19952](https://cve.now/CVE-2019-19952.md): In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to ReadOneMNGImage. (no CVSS)
- [CVE-2019-19949](https://cve.now/CVE-2019-19949.md): In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick\_png\_wri (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.